zephyrproject zephyr up to 4.4.x subsys/net/ip/tcp.c net_tcp_foreach use after free

Summaryinfo

A vulnerability marked as critical has been reported in zephyrproject zephyr up to 4.4.x. The impacted element is the function net_tcp_foreach of the file subsys/net/ip/tcp.c. This manipulation causes use after free. This vulnerability is tracked as CVE-2026-10634. The attack is only possible within the local network. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in zephyrproject zephyr up to 4.4.x. Affected by this vulnerability is the function net_tcp_foreach of the file subsys/net/ip/tcp.c. The manipulation with an unknown input leads to a use after free vulnerability. The CWE definition for the vulnerability is CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. As an impact it is known to affect availability. The summary by CVE is:

Zephyr's native TCP stack iterates the global connection list in net_tcp_foreach() (subsys/net/ip/tcp.c) using the SYS_SLIST_FOR_EACH_CONTAINER_SAFE macro, which caches a pointer to the next list node. Prior to this fix the function released tcp_lock while invoking the per-connection callback and re-acquired it afterwards. During that window a concurrent tcp_conn_release(), running on the dedicated TCP work-queue thread when a connection's reference count drops to zero (e.g. a remote peer closing or resetting the connection), can remove and k_mem_slab_free() the cached next connection. When the iterator advances it dereferences the freed (and possibly reallocated) slab memory — a use-after-free that can crash the system (denial of service) and, if the slot has been reused, cause the callback to operate on an attacker-influenced object (potential information disclosure or further fault). net_tcp_foreach() is reached in production via the 'net conn' network shell command and via net_tcp_close_all_for_iface() on interface-down; the freeing side is driven by ordinary TCP traffic. The fix moves the connection/context teardown in tcp_conn_release() inside the tcp_lock critical section and keeps tcp_lock held across the callback in net_tcp_foreach(). The defect was introduced with the modern (TCP2) stack in 2020 and affects releases up to and including v4.4.0.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-10634 since 06/02/2026. The exploitation appears to be difficult. The attack needs to be initiated within the local network. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 4.5.0 eliminates this vulnerability. Applying the patch cd85e0e890ab89815c4cbc0a8fbc03a3efa84dc2 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Project Management Software

Vendor

• zephyrproject

Name

• zephyr

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion